TMA-GITLAB-2.4.1
Ensure all artifacts on all releases are signed
HighLevel 1Manual reviewgitlab
Description
Sign all artifacts in all releases with user or organization keys. Signing artifacts is used to validate both their integrity and security. Organizations signal that artifacts may be trusted and they themselves produced them by ensuring that every artifact is properly signed. The presence of this signature also makes potentially malicious activity far more difficult.
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
Ensure every artifact in every release is signed.
How it is fixed
Fix method: Guidance or infrastructure patch
For every artifact in every release, verify that all are properly signed.
Properties
- Operating systems
- Any
- Tags
- devsecopsgitlab
- Reference
- CIS GitLab Benchmark v1.0.1 - 2.4.1 Ensure all artifacts on all releases are signed